Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
753 detections
Filters
Last updated
All Time
Detection languages
360
138
78
48
41
Contributors
208
117
105
52
51
Categories
20,443
11,831
5,875
5,151
4,864
753
Platforms
523
138
56
46
39
Products / Services
193
171
94
52
51
MITRE Techniques
494
378
311
190
156
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
3
2
Detects unauthorized access or modification to common CI/CD credential files (.npmrc, .pypirc, .git-credentials, jenkins credentials.xml) and CI/CD configuration files (.github/workflows, .gitlab-ci.yml). The rule monitors both file system activities by non-standard processes and the execution of command-line tools that reference these sensitive files.
Detects anomalous file modification or deletion events targeting the SSH known_hosts file. This activity can be indicative of VECT ransomware, which zeroes out this file across compromised Linux and ESXi systems to suppress host-key warnings, enabling silent lateral movement via SCP and SSH.
This rule detects unauthorized processes attempting to create, modify, rename, or delete the 'Login Data' SQLite database files used by Google Chrome and Microsoft Edge to store saved credentials. By excluding legitimate browser processes and updates, the rule identifies potential credential theft attempts by infostealer malware or unauthorized actor tools.
Detects the use of native Windows utilities (vssadmin, wmic, powershell, wbadmin) to delete volume shadow copies or backup catalogs. This activity is commonly associated with ransomware or destructive attacks attempting to prevent system recovery.
Detects the deletion of staging artifacts using cmd.exe and the timeout command, a technique used by result.dll (GIFTEDCROOK) for self-deletion after exfiltration. This rule specifically looks for command-line patterns indicative of a delayed file deletion using `timeout /t 5` followed by `& del`.
Detects a sequence of events where a Google Cloud Storage bucket is deleted by a user, followed by the creation or modification of a Pub/Sub subscription referencing a Cloud Storage destination. This pattern is indicative of 'Universal Bucket Hijacking', where an attacker attempts to hijack a data stream by recreating a deleted bucket or reconfiguring a service to redirect traffic to an attacker-controlled destination.
This rule monitors for unauthorized changes to sensitive system, authentication, and configuration files, as well as the deletion or truncation of logging artifacts on SD-WAN appliances. This activity is indicative of an adversary attempting to modify credentials, evade detection, or clear their footprint by tampering with security-critical paths.
This rule monitors for suspicious file operations on Cisco vManage, vSmart, and vBond network devices. It detects attempts to delete system logs, unauthorized access or copying of sensitive system files (such as /etc/passwd or /etc/shadow), and the presence of suspicious strings in command lines that may indicate anti-forensic activity or the creation of rogue accounts.
Detects suspicious command-line activity involving 'cmd.exe' executing a batch file named 'cleanup_greenblood.bat' or other batch files from temporary directories with specific cleanup-related commands. This pattern is often associated with malware or post-exploitation cleanup activities.
Detects common self-deletion patterns used by Pony malware, including the use of 'cmd.exe' with 'del /f' targeting executables in temporary or application data directories, batch file self-deletion loops, and PowerShell 'Remove-Item' or '[System.IO.File]::Delete()' targeting its own image path.
Detects clearing of network connection history to remove forensic evidence
Detects concurrent suspicious network beaconing to Telegram API or IPInfo and high-volume destructive file operations (deletion or modification) on a specific host, indicative of TrymeLocker ransomware activity.
Detects suspicious self-deletion patterns associated with TrymeLocker malware. This includes processes spawning cmd.exe to execute file deletion commands (cmd /c del) or the use of batch scripts to remove the originating process executable and subsequently delete themselves.
Detects the execution of processes with command-line arguments indicative of destructive activity, such as wiping disks, partitions, or boot records, often associated with wiper malware.
Detects a suspicious self-deletion pattern associated with the Pay2Key ransomware, where an SFX dropper uses cmd.exe to execute a ping-based delay followed by fsutil to zero out the original dropper file, and subsequently performs mass deletion of remaining .exe and .bat files.
This rule detects suspicious command-line activity involving 'cmd.exe' that echoes content into a batch file within the 'C:\Windows\TEMP\' directory and subsequently deletes it. This pattern can be indicative of malware staging, temporary file execution, or attempts to clean up forensic evidence.
This rule detects unauthorized file creation, deletion, or execution activity occurring within the 'Program Files\Windows Media Player\' directory by processes other than standard Windows Media Player executables. It flags activity such as creating non-media files (executables, scripts) or using system binaries like cmd, powershell, wmic, or fsutil to perform file operations in this directory. This behavior is indicative of potential masquerading or persistence techniques where an attacker places malicious payloads in a seemingly legitimate system location.
Detects the execution of potentially suspicious cleanup and maintenance commands (e.g., clearing history, changing permissions, removing files) on Linux systems that are often associated with post-exploitation activity or evidence removal. The rule monitors for these patterns specifically when initiated by commands involving common suspicious file paths like 'isp.sh', 'lambsys', or '/var/tmp/.xlamb'.
Detects suspicious command-line activity involving 'cmd.exe' executing 'ping' to the loopback address (127.0.0.1) combined with an ampersand ('&') and a file deletion command ('del', 'delete', or 'erase'). This pattern is often indicative of an attacker attempting to test network connectivity or bypass security controls while also performing cleanup or destructive actions.
Detects the self-deletion pattern used by the Supper backdoor, which involves a specific 'ping' command delay structure followed by a 'Del /f /q' command to remove itself from disk after execution. This pattern has been associated with Interlock and Rhysida ransomware.
Detects the modification of Azure Storage account management policies where the 'daysAfterModificationGreaterThan' condition is set to 7 days or less, specifically including a 'delete' action. This could indicate an attempt by an adversary to shorten the lifecycle of data for rapid, automated, and potentially malicious data destruction within Azure Blob Storage.
Page 22 of 36